Windows File System (1)

In modern operating systems, file systems provide stream-based data management for storage devices, allowing applicationsProgramShared volume storage space, while exclusive to different data streams. In Windows, the file system provides a hierarchical namespace and integrates the global namespace of the system. The file object is the abstraction of the opened instance of the device object, it also represents an open data stream instance in the file system. Windows file systems are based on volume device objects. Different types of file systems define different storage formats. The description of the file system format also determines its data management capabilities, such as file access permission management, whether to compress, and the maximum size of a single file. The file system is only a link in the storage management structure of windows. Its drivers are located at the top of the storage stack. They usually rely on the cache manager to cache file data.

The native File System Supported by Windows is NTFS (NT file system), and its driver is NTFS. sys; another common file system is fileallocation table, which is a legacy of the DOS era. Its format is relatively simple and is still widely used in mobile media, in addition to NTFS and FAT file systems, Microsoft also provides some other file system drivers for Windows, including CDFs and udfs. CDFs is the CD-ROM file system, which is a read-only file system, its driver is CDFs. sys; udfs is the UDF file system, mainly for DVD-ROM,
It is more flexible than CDFs, and its driver is udfs. sys.

In Windows's global namespace, the file system driver object is specified to be stored in the \ FileSystem directory. For example, "\ FileSystem \ NTFS" and "\ FileSystem \ CDFs. When Windows loads these drivers, if the type value is 2 (macro service_file_system_driver) in the Registry key (HKLM \ System \ CurrentControlSet \ service \ <drivername>) of the driver) or 8 (macro service_recognizer_driver). Then, the iopgetdrivernamefromkeynode function returns the name prefixed with "\ FileSystem", or the name prefixed with "\ driver. The ioploaddriver function calls the lopgetdrivernamefromkeynode function to determine the name of the driver object.

(Note: loploaddriver and lopgetdrivernamefromkeynode are non-public functions in Ntdll ).

Windows DDK provides CDFs and FAT file systemSource codeThe reader can compile these two drivers and then replace the original files. This method can be used to track and observe the running of Windows file systems.

From the driver structure, in addition to providing standard distribution routines, the file system driver is more inclined to provide fast I/O entries, this is because the overhead of "constructing IRP" can be avoided through the quick I/O entry. Secondly, file system drivers usually use the cache manager to provide file-level caching capabilities. Although this is not necessary, the cache manager essentially provides a public cache mechanism for the file system. As long as the file system driver uses the cache function of the cache manager properly, it can gain advantages in performance, memory usage efficiency, and other aspects at a relatively small cost. In addition to using the cache manager's caching capabilities for each opened file, the file system driver can also use the ccmapdata, ccpinread,
Ccpreparepinwrite and other interface functions map or lock the metadata on the volume to the system address space, and then operate the data conveniently. Displays the structure of a file system driver and its close relationship with the I/O manager and cache manager.

To effectively manage a volume, the file system driver usually uses some internal data structures to maintain the status of the volume, directory, and file. A most basic data constructor VCB (volume control block). VCB usually contains the volume device objects corresponding to a file system instance.

In a file system, there are usually two types of objects: Directory and file ). A file represents a data stream, and an application can read and write data from the file. A directory is a container object used in a file system to effectively organize multiple files. It does not contain user data streams. The directory and file are represented by both the data structure on the volume, on-disk representation, or in-memory representation (in-memory representation ). On a disk, the most basic unit for data management is the sector. The size of the sector on an intel X86 system is usually 512 bytes, the file system can manage the data on the disk at a larger granularity. This granularity is called cluster, which is an integer multiple of the size of the sector. Therefore, from the perspective of file system management, a file is composed of a group of clusters, which form a storage space for file data streams. The directory also contains one or more clusters, the data in these clusters describes the files in the directory, including their file attributes and the location information of the cluster. Different file systems can define different disk structures. For files or directories referenced during system operation, the file system driver must describe them using an appropriate memory data structure. They are called FCB (File
Control Block) and DCB (directroy control block ).